Detecting Mailbox Forwarding Rules to Specific External Domains Such as Gmail
This query identifies mailbox forwarding rules configured to a predefined list of external domains, including Gmail, Yahoo, Outlook.com, and Proton Mail.
Microsoft Sentinel (KQL)

